Almost every conversation we have with a new client starts the same way: "what DISP level do we need?" It's a reasonable question, and it has a slightly inconvenient answer — there isn't one level. There are four, one for each security domain, and the right answers are usually lower than businesses assume.
The four levels, mapped to classification
DISP has four membership levels — Entry Level, Level 1, Level 2 and Level 3 — and each aligns directly to an Australian Government security classification: Entry Level covers OFFICIAL and OFFICIAL: Sensitive, Level 1 covers PROTECTED, Level 2 covers SECRET, and Level 3 covers TOP SECRET. The level you hold determines the classification of information you're accredited to handle.
The four domains, and why level isn't one number
Here's the part that trips people up: you don't pick a single DISP level for your whole business. You pick a level for each of four domains — security governance, personnel security, physical security, and ICT/cyber security — based on what that specific domain needs to handle. A company might sit at Level 1 for personnel security because a handful of staff need PROTECTED access, while its ICT environment only needs to handle OFFICIAL information and stays at Entry Level.
The one exception is security governance. That domain always has to match the highest level you hold anywhere else, because governance is what proves the rest of the system is actually being managed properly.
Above Entry Level, you need a business case
Defence doesn't let you apply for the highest tier "to be safe." From Level 1 upward, your application needs a genuine business case — a real justification tied to the work you actually do or the contract you're pursuing. Overstating your required level doesn't just slow the application down; it adds ongoing audit and reporting burden you didn't need to carry.
Sponsoring clearances: what DISP membership does and doesn't let you do
Once you're a member above Entry Level, you can sponsor security clearances for your staff — but only if your organisation's Security Officer holds at least an NV1 clearance themselves. There's a hard ceiling here too: DISP members cannot sponsor Positive Vetting (PV) clearances. Those require direct Defence sponsorship at a senior level, regardless of your DISP membership status.
Getting the scoping right
In our experience, applications stall for one of two reasons: the business case doesn't match the level requested, or the domains haven't been scoped separately and the application ends up asking for more than it can justify. Getting this right domain by domain, before you submit anything, is usually the difference between an application that moves in weeks and one that drags for months.